Its only worse than not having it at all in the sense of giving users a false sense of security.
Flathub’s website has a bigass banner telling you if an app requires permissions that they consider dangerous. And flatpak’s CLI tells you what permissions are needed when installing an app. It’s pretty hard to miss, no?